0

I currently have Draytek 2860 router that handles IPv6 in the following modes

  • SLAAC (Stateless Configuration)
  • SLAAC (Stateless Configuration with Other configuration Flag)
  • DHCPv6 (StateFull)

What I'm trying to achieve is safe IPv6 global address I.E one which does not use the MAC address (I know i can use privacy extensions but certain IOT things do not support this on my network) and the ability to route locally using the Unique Local Address

This all goes away if i could get a static Prefix from my ISP BT but they don't

So using SLAAC i can get a Unique Local Address assigned to my Ubuntu server 16.04 LTS and Desktop 16.10 but that includes the MAC address.

Using DHCPv6 i can get a generated IPv6 address effectively hiding my MAC but no Unique Local Address.

So how do i hide my MAC address excluding privacy extensions while maintaining a Unique Local Address?

I have raised this with Draytek directly and been told it must be a machine configuration as they can assign Unique local Address while running in DHCPv6 mode

1 Answer 1

1

The best solution for what you want is probably using SLAAC (with optionally stateless DHCPv6 / other config flag for communicating the DNS resolvers) and enabling privacy addresses on your Ubuntu boxes. By default it uses the EUI-64 algorithm based on the MAC address, but that is easy to change in /etc/sysctl.d/10-ipv6-privacy.conf:

# IPv6 Privacy Extensions (RFC 4941)
# ---
# IPv6 typically uses a device's MAC address when choosing an IPv6 address
# to use in autoconfiguration. Privacy extensions allow using a randomly
# generated IPv6 address, which increases privacy.
#
# Acceptable values:
#    0 - don’t use privacy extensions.
#    1 - generate privacy addresses
#    2 - prefer privacy addresses and use them over the normal addresses.
net.ipv6.conf.all.use_tempaddr = 0
net.ipv6.conf.default.use_tempaddr = 0

In your case you probably want to set both those options to 2.

7
  • The only problem is that Network Manager does not respect this setting. If NM is used Privacy Extensions can be enabled per-connection in NM config.
    – Pilot6
    Mar 28, 2017 at 10:17
  • I agree that privacy extensions would be very useful for my Ubuntu machine and in fact configured this already. But other items like Google Nest Protects, other boxes i cant enable this kind of setting. So why is Ubuntu ignoring ULA in DHCP mode Mar 28, 2017 at 10:49
  • @PeterDuckett It is not clear what you mean by "Ubuntu ignoring ULA". If Privacy extensions are enabled I get both temporary privacy addresses for ULA and for global prefix. And you do not need DHCPv6 for that. If you use a stateful DHCPv6, the addresses are controlled by your router.
    – Pilot6
    Mar 28, 2017 at 11:09
  • i'm interesting in two modes of the router and how Ubuntu handles them. If i use SLAAC I get all three address, Link, Local, Global No problems if i enable privacy extensions also Except that other devices on that LAN segment expose their MAC due to embedded OS (Think Google Nest). In DHCP every thing gets a link and global address (Global being effectively NAT by the DHCP server (I know this is not NAT)) But no Unique Local Address is ever created when DHCP is the primary IP address provider Mar 28, 2017 at 11:34
  • And there is no point in hiding your ULA address. It is not seen from outside.
    – Pilot6
    Mar 28, 2017 at 11:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .